Unscored severity · published Oct 28, 2026
CVE-2026-117616
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission…
New
–
CVSS
–
EPSS
No
On KEV
Description
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jenkins · Jenkins
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117616
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117616
www.jenkins.io
https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4188
More from Jenkins
9.9
CVE-2019-1003029
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
9.9
CVE-2019-1003030
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
9.8
CVE-2024-23897
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
9.8
CVE-2018-1000861
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in…
9.8
CVE-2017-1000353
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution